Forensic Review with Notepad++
In this post Hoyt Harness writes about how to add Plugin Manager to Notepad++ and make it very extensible and useful for dig…
Make Your Debian a Forensic Workstation
If you are looking for a SIFT replacement and already have a Debian workstation, this package is for you. Forensics-full pac…
Autopsy 4.6.0 Linux Beta 1
The first beta Linux version of your favourite open source DFIR tool Autopsy. You can download it here. Now the tool has the…
The Sleuth Kit and Autopsy 4.6.0 have been released
The Sleuth Kit and Autopsy 4.6.0 are available for downloading. Here are the lists of new features: The Sleuth Kit New Commu…
Incident Response Tools
In this post Harlan Carvey has presented his views on incident response tools. In the post you’ll find both “cla…
Carve and recreate VSS catalog with vss_carver
Minoru Kobayashi has presented a tool for carving and recreating deleted VSS at at Japan Security Analyst Conference 2018. T…
Carving Fragmented Registry Files
Yet another registry parser, or yarp, is a library and tools to deal with Windows registry files [1]. Despite the name, yarp…
How to Mount Mac APFS Images in Windows
In the first post of the new year Mari Degrazia is writing about mounting APFS images in Windows. The thing is, Paragon has …
Incident Response Script for APT Hunting
Sergey Golovanov and Igor Soumenkov have prepared a New Year present for DFIR community: they have presented their script fo…
Covert Post Exloitation Forensics with Metasploit
Here is a talk by Wesley McGrew from Defcon 19 about coverting post-exloitation forensics with Metasploit: …
